Docs API CA certs

CA certs

CA certs are called signing certs inside the API.

Fields

  • cert_type - intermediate or root.
  • expires_at - Expiration time of the public cert. (Read-only)
  • key_availability - offline or online.
  • key_type - ec_256, ec_384, ec_521, rsa_2048, rsa_3072, or rsa_4096. (Read-only)
  • id - CertFu’s ID for the cert, eg: scrt_sample123456. (Read-only)
  • in_use - When true, ineligible to be deleted (has dependent certs or directories). (Read-only)
  • name - Display name of the cert.
  • object - Always signing_cert. (Read-only)
  • private_key - PEM-formatted private key.
  • private_key_type - When creating an online cert, type of private key to use. Same values as key_type.
  • public_cert - PEM-formatted public cert.
  • signing_cert_id - Parent CA cert that signed this cert.
Required permissions
API Permission
List, Retrieve, Create, Update, Delete admin

List CA certs

Query params
  • cert_type - Filter by cert_type.
  • signing_cert_id - Filter by parent signing_cert_id.
  • Plus standard paging params.
Request
GET /v1/signing_certs
GET /v1/signing_certs?cert_type=root
Response

On success, 200 with 0 or more CA certs.

{
  "collection": [
    {
      "cert_type": "root",
      "expires_at": "2026-01-01T00:00:00Z",
      "id": "scrt_sample123456",
      "key_availability": "online",
      "key_type": "ec_384",
      "name": "MyOrg Root CA 1",
      "object": "signing_cert",
      "public_cert": "-----BEGIN CERTIFICATE-----\n(sample)\n-----END CERTIFICATE-----",
      "signing_cert_id": null
    },
    {
      "cert_type": "intermediate",
      "expires_at": "2026-01-01T00:00:00Z",
      "id": "scrt_sample234567",
      "key_availability": "online",
      "key_type": "ec_256",
      "name": "MyOrg Intermediate CA 1",
      "object": "signing_cert",
      "public_cert": "-----BEGIN CERTIFICATE-----\n(sample)\n-----END CERTIFICATE-----",
      "signing_cert_id": "scrt_sample123456"
    }
  ],
  "more_results": false
}

Retrieve a CA cert

Request
GET /v1/signing_certs/scrt_sample123456
Response

On success, 200 with the CA cert.

{
  "cert_type": "intermediate",
  "expires_at": "2026-01-01T00:00:00Z",
  "id": "scrt_sample123456",
  "in_use": false,
  "key_availability": "online",
  "key_type": "ec_256",
  "name": "MyOrg Intermediate CA 1",
  "object": "signing_cert",
  "public_cert": "-----BEGIN CERTIFICATE-----\n(sample)\n-----END CERTIFICATE-----",
  "signing_cert_id": "scrt_sample123456"
}

Create a CA cert

Request
POST /v1/signing_certs

{
  "signing_cert": {
    "cert_type": "root",
    "key_availability": "online",
    "name": "MyOrg Root CA 1",
    "private_key_type": "ec_384"
  }
}
Response

On success, 201 with the new CA cert.
On error, 422 with standard error response.

{
  "cert_type": "root",
  "expires_at": "2026-01-01T00:00:00Z",
  "id": "scrt_sample123456",
  "in_use": false,
  "key_availability": "online",
  "key_type": "ec_384",
  "name": "MyOrg Root CA 1",
  "object": "signing_cert",
  "public_cert": "-----BEGIN CERTIFICATE-----\n(sample)\n-----END CERTIFICATE-----",
  "signing_cert_id": null
}
Request
POST /v1/signing_certs

{
  "signing_cert": {
    "cert_type": "root",
    "key_availability": "offline",
    "public_cert": "-----BEGIN CERTIFICATE-----\n(sample)\n-----END CERTIFICATE-----"
  }
}
Response

On success, 201 with the new CA cert.
On error, 422 with standard error response.

{
  "cert_type": "root",
  "expires_at": "2026-01-01T00:00:00Z",
  "id": "scrt_sample123456",
  "in_use": false,
  "key_availability": "offline",
  "key_type": "ec_384",
  "name": "MyOrg Root CA 2",
  "object": "signing_cert",
  "public_cert": "-----BEGIN CERTIFICATE-----\n(sample)\n-----END CERTIFICATE-----",
  "signing_cert_id": null
}
Request
POST /v1/signing_certs

{
  "signing_cert": {
    "cert_type": "intermediate",
    "key_availability": "online",
    "name": "MyOrg Intermediate CA 1",
    "private_key_type": "ec_256",
    "signing_cert_id": "scrt_sample123456"
  }
}
Response

On success, 201 with the new CA cert.
On error, 422 with standard error response.

{
  "cert_type": "intermediate",
  "expires_at": "2026-01-01T00:00:00Z",
  "id": "scrt_sample123456",
  "in_use": false,
  "key_availability": "online",
  "key_type": "ec_256",
  "name": "MyOrg Intermediate CA 1",
  "object": "signing_cert",
  "public_cert": "-----BEGIN CERTIFICATE-----\n(sample)\n-----END CERTIFICATE-----",
  "signing_cert_id": "scrt_sample123456"
}
Request
POST /v1/signing_certs

{
  "signing_cert": {
    "cert_type": "intermediate",
    "key_availability": "online",
    "private_key": "-----BEGIN EC PRIVATE KEY-----\n(sample)\n-----END EC PRIVATE KEY-----",
    "public_cert": "-----BEGIN CERTIFICATE-----\n(sample)\n-----END CERTIFICATE-----",
    "signing_cert_id": "scrt_sample123456"
  }
}
Response

On success, 201 with the new CA cert.
On error, 422 with standard error response.

{
  "cert_type": "intermediate",
  "expires_at": "2026-01-01T00:00:00Z",
  "id": "scrt_sample123456",
  "in_use": false,
  "key_availability": "online",
  "key_type": "ec_256",
  "name": "MyOrg Intermediate CA 2",
  "object": "signing_cert",
  "public_cert": "-----BEGIN CERTIFICATE-----\n(sample)\n-----END CERTIFICATE-----",
  "signing_cert_id": "scrt_sample123456"
}

Update a CA cert

Request
PUT /v1/signing_certs/scrt_sample123456

{
  "signing_cert": {
    "name": "MyOrg Intermediate CA 1 (2026)"
  }
}
Response

On success, 200 with the updated CA cert.
On error, 422 with standard error response.

{
  "cert_type": "intermediate",
  "expires_at": "2026-01-01T00:00:00Z",
  "id": "scrt_sample123456",
  "in_use": false,
  "key_availability": "online",
  "key_type": "ec_256",
  "name": "MyOrg Intermediate CA 1 (2026)",
  "object": "signing_cert",
  "public_cert": "-----BEGIN CERTIFICATE-----\n(sample)\n-----END CERTIFICATE-----",
  "signing_cert_id": "scrt_sample123456"
}

Delete a CA cert

Request
DELETE /v1/signing_certs/scrt_sample123456
Response

On success, 202 with an empty response.
On error, 422 with standard error response.